QuickLens Chrome Extension Turns Rogue with Script Injection Attack

A Chrome extension named QuickLens transformed into a malicious tool after a quiet ownership change. It started injecting scripts and stripping browser security headers from all visited sites. Over 7,000 users faced risks from this silent update pushed on February 17, 2026.

QuickLens originally acted as a Google Lens wrapper for browser image searches. Users could capture screens, select areas, search YouTube frames, or check Amazon products. Google even gave it a Featured badge for solid performance.

Published on October 9, 2025, the extension hit ExtensionHub for sale just two days later. Annex Security researchers spotted the listing early. On February 1, 2026, ownership shifted to a shady entity tied to supportdoodlebuggle.top, with a fake LLC identity.

Version 5.8 brought the real danger. It added a command-and-control server at api.extensionanalyticspro.top. New permissions for declarativeNetRequestWithHostAccess and webRequest slipped past most users. A rules.json file wiped key protections like Content-Security-Policy, X-Frame-Options, and X-XSS-Protection.

Attack Mechanics

The core trick uses a 1×1 transparent GIF image for payload delivery. Here’s how it works in steps.

• C2 server sends JavaScript as string array to cached-agents-data in local storage.
• Extension reads this on every page load.
• Creates hidden base64 GIF image with onload handler running the script.
• CSP removal lets inline handlers execute freely.

Attackers gain full page access. They steal session tokens, grab form data, scrape content, and exfiltrate to remote servers. The extension still looks normal, masking the threat.

Key Indicators

Static scans miss this attack. Payloads load at runtime only. Names like safelyProcessElement blend with legit code.

Impact and Detection

Sites lose all header defenses. Clickjacking, XSS, and cross-origin attacks become easy. Data theft happens silently across sessions.

Organizations need extension blocklists. Watch for permission jumps, especially net request rules. Users should audit extensions weekly and reject odd prompts.

Google removed it post-discovery. But similar sales on ExtensionHub continue. Verify ownership changes fast.

FAQ